PostgreSQL patches 52 flaws, including authenticated RCE
Original title: PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
CVE-2026-6460, CVSS 8.8, needs object-creation rights; full protection also requires rebuilding C extensions.
The PostgreSQL project released fixes for 52 flaws, 32 scored 8.8. CVE-2026-6460 is a type-confusion bug that can let a user who creates objects run code as the database OS user; versions before 18.7, 17.12, 16.16, 15.20 and 14.25 are affected. The project and CISA report no known attacks. Researcher Mehmet Ince published a writeup that crashes 18.6 and leaks addresses but omits the final command-execution SQL. CVE-2026-116322 can let an unauthenticated client restart PostgreSQL 18.
Unconfirmed: Sources do not say whether a default-privilege login can move from the crash to code execution, and managed-service patch status is unstated.
- Fixed releases are 18.7, 17.12, 16.16, 15.20 and 14.25.
- PostgreSQL 14 is end of life; 14.25 is its last release.
- A crafted archive can make pg_restore run code as its user.
- Do not disable checks with composite_type_mismatch.
- After updating, reindex and take a new full backup if using incrementals.
Impact: Authenticated code execution as the PostgreSQL OS user
| Product | Affected | Fixed in |
|---|---|---|
| PostgreSQL Global Development Group PostgreSQL | before 18.7, 17.12, 16.16, 15.20, and 14.25 | 18.7, 17.12, 16.16, 15.20, 14.25 |
| PostgreSQL Global Development Group PostgreSQL | PostgreSQL 18 | — |
- 1.Update to 18.7, 17.12, 16.16, 15.20, or 14.25 for your major version.
- 2.Rebuild or update every C-language extension at the same time as the server.
- 3.Update pg_dump, pg_restore, reindexdb and vacuumdb; do not disable composite_type_mismatch.
- Products
- PostgreSQLpg_restorepg_dumppsql
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-6460+1 related CVE | Type confusion RCE in PostgreSQL for object creators | 8.8 group max | <1% | PoC |
From the original article
4 min read at thehackernews.com
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-language extensions installed on the server.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.